General

What is the recommended rollback steps for physical UVM appliances when doing BI or appliance management component upgrade.

If the domain managed system is onboarded in PAM and the local accounts is mapped with the domain managed system then which functional account will be used to domain or local functional account? does it need any additional permission on managed system?

Is there a way to change our managed admin accounts password rotation to every 4 or 6 hours? We don’t want our admin passwords to rotate after release, and are thinking 24 hour rotation may be too long of a gap.

Sometimes in organization there is requirement of providing access to one user of only server for specific time period only.How it is possible to automate the process of on demand access using smart rule in Password Safe?This is the biggest challenge as we have to create a separate managed account, group and smart rule for such access.I need a process where I can define that after specific time the access is revoked automatically and there is no dependency of password safe administrators. 

does anyone have any recommendations for service account? I have them on boarded based on Directory Query looking for members of an AD group called Interactive logon. they are onboarded but I need to link them to Managed system and present them only to the users that have access to the server they are linked to. I have an Idea on how to do this but it is not pretty. 

Password Safe Discovery Scanning Workflow  

Did you know Password Safe has a feature called Secrets Cache which can be leveraged in a DR/Outage situation to retrieve last known passwords for important break-glass accounts? This is extremely helpful when administrators are unable to access Password Safe. If communication with Password Safe is lost, the cache will provide the last known good managed account credentials even if the associated request has expired.In order to set this up, there are some roles and permissions that need to be configured for the user running the Secrets Cache. More details around requirements can be found here: https://www.beyondtrust.com/docs/beyondinsight-password-safe/ps/cache/requirements.htmIf you're using Password Safe and you haven't checked this feature out yet, I strongly encourage you to check out the user guide located here: https://www.beyondtrust.com/docs/beyondinsight-password-safe/ps/cache/index.htmLet me know if you have any questions below! 

Directory Query Configuration 

User Group Permissions and Role-Based Assignment  

Visual End-User Workflow Control 

Does anyone else face an issue with not being able to SSH from Password Safe to network devices running Cisco ISE after an update to Cisco ISE 17.10+?The reason is that from that version onwards, Cisco ISE only supports hmac-sha2-256-etm@openssh.com & hmac-sha2-512-etm@openssh.com as default MAC algorithms, which are not supported by Password Safe. The devices are running in a special SD-WAN controller mode where it is not possible to enable additional algorithms.It would be interesting to know if anyone has been in a similar situation and how the problem could be resolved.

User Account on Asset Report is not being Generated, under Analytics & Reporting Reports->AssetUser->Account. I am getting just 2 pages, i have more than 4000 servers in Passwordsafe, also scanned all the assets in this week only still I am not able to generate report.

users which are inactive in Active Directory but in Password Safe it's showing Active, I don’t know how it’s possible!! 

When downloading dump of assets from Asset tab in passwordsafe there are different column like AssetID    AssetName    DomainName    Type    WorkGroupName    DnsName    CreateDate    CreatedByUserID etc. All columns have data except CreatedByUserID it contains 0 only. Is there any fix available for this or any settings needed to be changed in PasswordSafe?

You already know your way around Password Safe? Curious about how assets, accounts, and workflows interconnect? Dive into the diagram below to see how all the pieces fit together seamlessly! For more details about Smart Groups and the best practices you should follow when implementing them, check out KB articles KB0018994 and KB0019495 on the Customer Portal—they're packed with useful insights!

As per the BeyondTrust Docs, Oracle scan credential supports IP address range and CIDR notation in the Host field. I tried multiple scenarios with IP address range or CIDR notation, discovery scan never worked. It works fine with single IP address and named host but not with IP address range or CIDR notation.Please advise on how to make discovery scan works with IP address range or CIDR notation?Create Oracle Credentials in BeyondInsight (beyondtrust.com) Thanks